Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

PT-2026-22571

A critical SQL Injection SQLi vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker AV:N/PR:N can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity AC:L and the absence o...

Changing IDExpert Windows Logon Agent 安全漏洞

Changing IDExpert Windows Logon Agent is an identity authentication client software developed by Changing, a company based in Taiwan, China. This software is designed to enhance security during Windows login processes. Changing IDExpert Windows Logon Agent contains a security vulnerability that...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that stems from a lack of privilege checking, which can be exploited by attackers to obtain sensitive information...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to cause local elevation of privilege...

TP-Link Deco BE25 安全漏洞

The TP-Link Deco BE25 is a router produced by the TP-Link company. The TP-Link Deco BE25 v1.0, 1.1.1 Build 20250822, and earlier versions have security vulnerabilities. These vulnerabilities stem from improper handling of inputs in the management web interface, which may allow authenticated...

Changing IDExpert Windows Logon Agent 安全漏洞

Changing IDExpert Windows Logon Agent is an identity authentication client software developed by Changing, a company based in Taiwan, China. This software is designed to enhance security during Windows login processes. Changing IDExpert Windows Logon Agent contains a security vulnerability that...

PT-2026-23539

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12 Description The software uses non-constant-time string comparison for hook token validation. This allows attackers to potentially infer tokens through timing measurements. Remote attackers with network acce...

TP-Link Deco BE25 安全漏洞

The TP-Link Deco BE25 is a router produced by TP-Link Corporation. The TP-Link Deco BE25 v1.0, 1.1.1 Build 20250822, and earlier versions have security vulnerabilities. These vulnerabilities stem from path traversal attacks, which may allow authenticated neighboring attackers to read arbitrary...

The vulnerability of Microprogrammed Software in ExaGrid backup devices, related to information disclosure, allows attackers to gain access to the protected information.

The vulnerability of ExaGrid backup device’s microprogramming software is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the protected information...

5 Best Kenna Replacement Options to Consider

Attackers don't think in terms of isolated CVE scores. They look for the path of least resistance, chaining together multiple weaknesses across your entire attack surface to reach their goal. This is why the search for a Kenna replacement is so critical. It’s not just about finding a new tool to...

CVE-2026-27753

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online password guessing attacks without account lockout or rate...

CVE-2025-14142

The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-25195

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route...

PT-2026-22465

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.7 Description The Tutor LMS plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the coupon code parameter is not properly sanitized,...

CVE-2026-27753

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online password guessing attacks without account lockout or rate...

CVE-2026-24351 Stored XSS in PluXml CMS

PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with...

EUVD-2026-9017

The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-14040

CVE-2025-14040 : The Automotive Car Dealership WordPress Theme (WordPress theme) is vulnerable to a stored XSS via the action_text, action_button_text, action_link, and action_class fields in the Call to Action across all versions up to 13.4. Exploitation requires contributor-level authentication...

EUVD-2026-8986

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN Instant Payment Notification verification being disabled by default disableipnverification defaults to...